Role-Based Access Control (RBAC)

SUB_ID=$(az account show --query id -o tsv)

# Tạo Resource Group
az group create \
  --name rg-az104-m05 \
  --location southeastasia \
  --tags Course=AZ-104 Module=05 Environment=Lab

# Tạo test user trong Entra ID
az ad user create \
  --display-name "RBAC Test User" \
  --user-principal-name rbactestuser@$(az account show --query tenantId -o tsv).onmicrosoft.com \
  --password "P@ssw0rd2024!" \
  --force-change-password-next-sign-in false

# Lấy Object ID của user vừa tạo
USER_OID=$(az ad user list \
  --display-name "RBAC Test User" \
  --query "[0].id" -o tsv)
echo "User OID: $USER_OID"

# Gán role Reader tại scope Resource Group
az role assignment create \
  --assignee $USER_OID \
  --role "Reader" \
  --scope "/subscriptions/$SUB_ID/resourceGroups/rg-az104-m05"

echo "Reader role assigned to RBAC Test User on rg-az104-m05"

SUB_ID=$(az account show --query id -o tsv)

# Tạo custom role definition JSON
cat > /tmp/storage-reader-nodelete.json << EOF
{
  "Name": "Storage Reader No Delete",
  "Description": "Xem storage accounts và đọc blob data, nhưng không được xóa",
  "Actions": [
    "Microsoft.Storage/storageAccounts/read",
    "Microsoft.Storage/storageAccounts/listKeys/action",
    "Microsoft.Resources/subscriptions/resourceGroups/read"
  ],
  "NotActions": [
    "Microsoft.Storage/storageAccounts/delete"
  ],
  "DataActions": [
    "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
  ],
  "NotDataActions": [],
  "AssignableScopes": [
    "/subscriptions/$SUB_ID"
  ]
}
EOF

# Tạo custom role
az role definition create \
  --role-definition /tmp/storage-reader-nodelete.json

echo "Custom role 'Storage Reader No Delete' created"

# Gán custom role cho test user tại RG scope
USER_OID=$(az ad user list --display-name "RBAC Test User" --query "[0].id" -o tsv)

az role assignment create \
  --assignee $USER_OID \
  --role "Storage Reader No Delete" \
  --scope "/subscriptions/$SUB_ID/resourceGroups/rg-az104-m05"

SUB_ID=$(az account show --query id -o tsv)
USER_OID=$(az ad user list --display-name "RBAC Test User" --query "[0].id" -o tsv)

# Tạo Storage Account để test
STORAGE_NAME="stm05rbac$(date +%s | tail -c 5)"
az storage account create \
  --name $STORAGE_NAME \
  --resource-group rg-az104-m05 \
  --location southeastasia \
  --sku Standard_LRS \
  --kind StorageV2 \
  --tags Course=AZ-104 Module=05

echo "Storage account: $STORAGE_NAME"

# Xem tất cả role assignments của user tại RG này
az role assignment list \
  --assignee $USER_OID \
  --scope "/subscriptions/$SUB_ID/resourceGroups/rg-az104-m05" \
  --include-inherited \
  -o table

# Xem tất cả role assignments toàn subscription (bao gồm kế thừa)
az role assignment list \
  --assignee $USER_OID \
  --all \
  --include-inherited \
  -o table

SUB_ID=$(az account show --query id -o tsv)

# Tạo VM nhỏ với System-Assigned Managed Identity
az vm create \
  --resource-group rg-az104-m05 \
  --name vm-rbac-test \
  --image Ubuntu2204 \
  --size Standard_B1s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --assign-identity \
  --location southeastasia \
  --tags Course=AZ-104 Module=05

# Lấy Principal ID của Managed Identity
MI_PRINCIPAL=$(az vm show \
  --resource-group rg-az104-m05 \
  --name vm-rbac-test \
  --query "identity.principalId" -o tsv)

echo "Managed Identity Principal ID: $MI_PRINCIPAL"

# Gán role Storage Blob Data Reader cho Managed Identity
# Để VM có thể đọc blob mà không cần credential
az role assignment create \
  --assignee $MI_PRINCIPAL \
  --role "Storage Blob Data Reader" \
  --scope "/subscriptions/$SUB_ID/resourceGroups/rg-az104-m05"

echo "Storage Blob Data Reader assigned to VM Managed Identity"

SUB_ID=$(az account show --query id -o tsv)

# Xóa role assignments trước khi xóa user/role
USER_OID=$(az ad user list --display-name "RBAC Test User" --query "[0].id" -o tsv)

az role assignment delete \
  --assignee $USER_OID \
  --role "Reader" \
  --scope "/subscriptions/$SUB_ID/resourceGroups/rg-az104-m05"

az role assignment delete \
  --assignee $USER_OID \
  --role "Storage Reader No Delete" \
  --scope "/subscriptions/$SUB_ID/resourceGroups/rg-az104-m05"

# Xóa custom role definition (bắt buộc xóa hết assignments trước)
az role definition delete --name "Storage Reader No Delete"

# Xóa test user
az ad user delete --id $USER_OID

# Xóa Resource Group (xóa VM, storage, và toàn bộ resource)
az group delete --name rg-az104-m05 --yes --no-wait